Skip to main content
Glama
Heretek-RE

re-speakeasy

by Heretek-RE
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

re-speakeasy

MCP server for Speakeasy (Mandiant, Apache-2.0) — Windows API emulation for binary analysis. The "run a .exe in a Wine-like sandbox and tell me what it did" tool.

Why

The other RE-AI MCP servers analyze binaries statically (no execution): re-lief reads headers, re-rizin disassembles, re-triton symbolically executes individual functions. None of them can answer "what APIs does this .exe call, with what arguments, in what order, when I run it?"

re-speakeasy fills that gap. Speakeasy is a Windows API emulator — it loads the .exe / .dll in-process and serves the same Win32 surface that Windows would, but in pure Python. The output is a per-API trace that complements the static analysis: "the static strings say this binary calls CreateFileW" + "the dynamic trace confirms it calls CreateFileW("C:\\Users\\...", GENERIC_READ, ...)".

Related MCP server: re-mcp

Architecture

The Python MCP server is a thin wrapper around a speakeasy-cli Python helper installed by install.sh:

Claude Code (MCP stdio)
  │
  ▼
re-speakeasy server (Python, this directory)
  │  subprocess.run(...)
  ▼
speakeasy-cli (small Python script, wraps the Speakeasy API)
  │
  └─ speakeasy-emulator (pip-installed, the actual emulator)

The subprocess boundary is intentional: Speakeasy is a heavy Python package with rich in-process APIs. The subprocess wrapper keeps the MCP server's memory footprint small and lets Claude Code load the plugin in degraded mode if Speakeasy isn't installed.

Tools

Tool

What it does

check_speakeasy

Health check — return Speakeasy version + API count

emulate_binary

Run a .exe / .dll under Speakeasy, return per-API trace

list_emulated_apis

Return the count + sample of the Win32 API catalog Speakeasy emulates

Install

./install.sh installs speakeasy-emulator from PyPI.

To install standalone:

pip install speakeasy-emulator

Requirements

  • Python 3.11+

  • speakeasy-emulator (Apache-2.0, on PyPI)

  • No system dependencies

Degraded mode

If speakeasy-cli is not installed, every tool returns {"status": "WARN", "error": "speakeasy-cli not installed; run install.sh", ...}. The Python MCP server itself always loads so Claude Code can surface the install hint.

Pairing with re-winedbg

re-winedbg runs a Windows .exe under Wine (the full Windows compatibility layer, including x86_64 emulation) and exposes a gdbserver for interactive debugging. re-speakeasy runs the .exe under Speakeasy (the pure-Python emulator, no real CPU) and returns a structured API trace.

  • Use re-speakeasy.emulate_binary for "what did this binary do, end-to-end, with a structured trace?" — fast, no x86 emulation, can be retried safely.

  • Use re-winedbg.start_winedbg_gdbserver for "I want to step through this binary interactively, with breakpoints" — slower (full Wine + gdbserver), but gives the analyst control.

For the encrypted-VM bytecode family: re-speakeasy.emulate_binary is the right first call (let the encrypted stub decrypt, watch the dispatcher fire, see which handlers execute); re-winedbg is the right follow-up when the analyst wants to break at a specific handler entry.

Pairing with re-leak-scan

The Speakeasy trace includes network calls (WinHttpOpen, WSAConnect, InternetOpenUrl, ...). Cross-reference against re-leak-scan.find_secrets to confirm whether the dynamic calls match the static string-table leaks. The Sentry DSN or Logstash URL in the strings is a credential; the same URL appearing in the Speakeasy trace is the actual call site.

Available Tools

3 tools
check_speakeasyA

Return speakeasy-cli version + Python module availability.

Reports WARN (not ERROR) when the helper is not found. The fallback chain: $RE_SPEAKEASY_CLI_PATH -> <server>/bin/speakeasy-cli -> PATH.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the warning behavior (WARN not ERROR) and the fallback chain for locating the helper, providing good transparency beyond what annotations (none provided) would cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise two-sentence description: first sentence states purpose, second explains behavior and fallback. No unnecessary words, front-loaded key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Completeness is high for a simple check tool with no parameters and no output schema. Covers return value, behavior on failure, and fallback chain. Missing output format detail but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so baseline score of 4 applies. Description adds behavioral context beyond schema but does not need to explain parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool returns speakeasy-cli version and Python module availability. Uses specific verb 'return' and resource, distinct from sibling tools like emulation and API listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage as a diagnostic check, mentions that WARN is reported instead of ERROR when helper is not found, but lacks explicit when-to-use or when-not-to-use guidance relative to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

emulate_binaryA

Run path under Speakeasy and return a structured per-API trace.

Speakeasy is a Windows API emulator — it loads the .exe / .dll in-process and serves the same Win32 surface that Windows would, but in pure Python. The trace captures every API call the binary makes (CreateFileW, RegOpenKeyExW, NtCreateFile, etc.) with arguments + return values.

Args: path: Windows .exe / .dll to emulate timeout_s: wall-clock budget (default 60s; binaries that loop or call Sleep(INFINITE) can hang the emulator)

Returns::

{"path": "...",
 "trace": [
    {"api": "CreateFileW", "args": [...], "return": "...",
     "timestamp_ns": N, "module": "kernel32"},
    ...
 ],
 "summary": {"api_count": N, "unique_apis": [...],
             "files_accessed": [...], "registry_keys": [...],
             "processes_spawned": [...], "network_calls": [...]}}

On a missing helper, returns {"status": "WARN", "error": "speakeasy-cli not installed", ...} so the agent knows to retry after install.sh.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
timeout_sNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the in-process loading, the emulator surface, the trace structure, and the error case for missing helper. It does not mention concurrency, memory, or side effects, but is generally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear summary, explanation of Speakeasy, parameter details, and return format. It is slightly verbose but each sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (2 parameters, no output schema), the description is highly complete. It explains the tool's operation, parameter behavior, return structure with an example, and error handling, leaving no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must add meaning. It clearly explains 'path' as Windows .exe/.dll to emulate and 'timeout_s' as wall-clock budget with a warning about hanging, providing crucial context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the tool runs a binary under Speakeasy and returns a structured per-API trace. It distinguishes itself from siblings (check_speakeasy, list_emulated_apis) by focusing on execution and trace generation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (to emulate a binary and get a trace) and mentions the timeout default and potential hanging, but does not explicitly state when not to use it or compare with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_emulated_apisA

Return the list of Win32 APIs Speakeasy knows how to emulate.

Useful for "can Speakeasy handle this binary's API surface?" before calling :func:emulate_binary on a long-running target. The list is large (thousands of APIs) — the default is to return the count and a few sample categories.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must fully disclose behavior. It explains the default output is not the full list but a count and sample categories, and mentions the list is large. This is sufficient for understanding the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two well-structured sentences. First states purpose, second provides usage guidance and output details. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage, and default output. It does not explicitly describe the output format or whether a full list can be obtained, but for a simple listing tool with no parameters, this is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters in schema, but description adds crucial context about default output behavior (count and sample categories) and scale (thousands of APIs). This goes beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns the list of Win32 APIs Speakeasy can emulate, using a specific verb ('Return') and resource ('list of Win32 APIs'). It differentiates from siblings by positioning itself as a pre-check before emulation, unlike 'emulate_binary' which actually emulates, and 'check_speakeasy' which is likely a different check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'Useful for "can Speakeasy handle this binary's API surface?" before calling emulate_binary on a long-running target.' This provides clear context and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.6/5.0
Disambiguation5/5

Each tool targets a distinct operation: checking setup, running emulation, and listing APIs. There is no overlap in purpose.

Naming Consistency5/5

All tool names follow the verb_noun pattern in snake_case (check_speakeasy, emulate_binary, list_emulated_apis), ensuring predictability.

Tool Count5/5

With 3 tools, the server is tightly scoped to its core functionality: verifying the environment, performing emulation, and querying capabilities. No unnecessary bloat.

Completeness5/5

The tool set covers the full workflow for Speakeasy integration: availability check, binary emulation, and API surface listing. No obvious gaps for the intended use case.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • re-mcp

    jtsylve
    A
    license
    Not graded
    quality
    B
    maintenance
    A multi-backend MCP server that exposes binary analysis capabilities from IDA Pro and Ghidra, allowing LLMs to directly drive reverse-engineering tools via natural language.
    140
    Apache 2.0

  • mem-forensics-mcp

    x746b
    A
    license
    B
    quality
    B
    maintenance
    Multi-tier memory forensics MCP server combining a fast Rust engine with Volatility3 coverage for analyzing memory dumps.
    15
    6
    MIT

  • frida-mcp

    neeetman
    F
    license
    B
    quality
    B
    maintenance
    A simple MCP server exposing persistent, scriptable Frida dynamic instrumentation to an AI agent for Windows reversing, malware/security analysis, and dynamic debugging.
    19

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Heretek-RE/re-speakeasy'

If you have feedback or need assistance with the MCP directory API, please join our Discord server